I see what I did wrong: I edited the smb.PDC.conf on the AD DC server
with a new domain name hoping both the AD DC and the existing NT4 PDC
would be up and running so I could move clients over one at a time to
minimize down time. So that's a no go. Instead of classicupgrade, if I
provision the new AD DC with a new domain name, would there be a way
to import users and groups from the NT4 domain into the new AD domain
so their profiles and files on existing samba shares could be readily
used under AD DC? There's not a lot of users, I could move them one at
a time manually if that's what takes.

Sorry, you cannot do this, the profiles contain the old SID. You could
create a new AD domain and then recreate your users and groups in it,
this is the easy part, you would then have to parse the profiles and
some how replace the old SID with the new SID.